Quantum random number generator for secure generation of random numbers using two entropy sources

Abstract

A quantum random number generator (10) for generating random numbers comprising at least two entropy sources (20) for generating an event; at least one evaluation unit (30) for processing the event; an output interface (50) for outputting a binary random number; wherein the entropy source (20) comprises a photon source and a photon receiver; the photon source randomly emits photons which are detected by the photon receiver and transmitted as an event to the evaluation unit (30); the evaluation unit (30) is configured to process the events and generate binary random numbers which are output via the output interface (50).

Description

[0001] The present invention relates to a quantum random number generator for generating random numbers with at least two entropy sources for generating an event, at least one evaluation unit for processing the event and for generating a binary random number, and with an output interface for outputting a binary random number.

[0002] Today, the secure and reliable generation of true random numbers is gaining increasing importance, particularly for encryption and cryptography, but also in networks or distributed networks without a central control instance. Security often depends directly on the quality and unpredictability of the random numbers. This is especially true for encryption, authentication, and other security-relevant operations. Random number generators must therefore produce absolutely unpredictable sequences, with quantum mechanisms and photon generation being among the best methods. For example, German patent DE 10 2022 125 572 A1 discloses a computer that includes at least one quantum process-based true random number generator (QRNG) with a high random bit output rate, particularly for encryption.

[0003] Random number generators, and especially quantum random number generators (QRNGs), often represent an attractive and worthwhile target for attacks and cyberattacks. They must therefore be particularly resistant to external or third-party manipulation. This includes both the targeted manipulation of the QRNGs and "eavesdropping" on and predicting the next random number.

[0004] To increase security, quantum random number generators (QRNGs) are used, which comprise an entropy source (a photon source) and a detector embedded in a semiconductor substrate. The entropy source and detector are arranged perpendicular to each other and to a surface of the semiconductor substrate, enabling a particularly high random number data rate. Such vertically oriented quantum random number generators in the semiconductor substrate guarantee that the generated random numbers are truly random, unpredictable, and of high entropy. "Entropy" refers to the uncertainty or information contained in a random number and represents the degree of unpredictability. It can be verified using the NIST SP800-22 standard developed by the National Institute of Standards and Technology (NIST).

[0005] Quantum random number generators (QRNGs) are preferably monolithically integrated into the semiconductor substrate and manufactured as a single unit. In addition to the entropy source (photon source) and the detector, the semiconductor substrate contains further elements. These may include: one or more analog amplifiers and / or filter circuits for conditioning the output signal of the entropy source for subsequent analog-to-digital conversion; a one- or multi-bit analog-to-digital converter (ADC), which, in the case of a one-bit ADC, may be a comparator; one or more time-to-digital converters (TDCs) and / or one or more time-to-pseudorandom number converters (TPRNCs) for assigning a unique binary number to a time interval between two pulses of the entropy source; and one or more entropy extraction devices for extracting one or more random bits from these binary numbers.one or more finite-state machines for converting the data stream of random bits into random numbers; one or more interfaces for one or more external computer systems to access these random numbers and / or to control the quantum random number generator; one or more components or elements for performing and / or supporting a health check of one or more of the elements and / or their interaction; one or more elements for generating the internal operating voltages within the quantum random number generator for operating the various elements or components of the quantum random number generator.

[0006] Such or similar quantum random number generators (quantum-based random number generators) that can be used within the scope of the invention are known, for example, from DE 10 2023 126 168 A1 or WO 2024 / 074170 A1. Quantum random number generators for generating random numbers, based on optical methods with one or more SPADs (Single Photon Avalanche Diodes) as detectors, are also known from Francesco Ceccarelli, et al.; "Recent Advances and Future Perspectives of Single-Photon Avalanche Diodes for Quantum Photonics Applications"; Adv. Quantum Technol. 2021, 4, 2000102.

[0007] The possibility of disrupting and influencing a quantum random number generator by means of external light irradiation, thus enabling manipulation or prediction of the random numbers, was shown, for example, in Juan Carlos Garcia-Escartin, et al.; "Attacking quantum key distribution by light injection via ventilation openings"; PLOS ONE | https: / / doi.org / 10.1371 / journal.pone.0236630; August 3, 2020.

[0008] Methods for detecting such attacks typically include startup, live, and total failure tests. The startup test verifies that all components of the QRNG are functioning correctly when it is powered on. The live test verifies the quality of the random numbers during operation of the QRNG using statistical tests. The total failure test detects a complete failure of the QRNG's entropy source or detector. These tests are described in Werner Schindler et al., "Evaluation Criteria for True (Physical) Random Number Generators Used in Cryptographic Applications"; BS Kaliski Jr. et al. (Eds.): CHES 2002, LNCS 2523, pp. 431-449, 2003.

[0009] There remains a great need to improve the security of quantum random number generators that use an entropy source and to make them robust against external influences, especially against interference radiation or optical interference via photon radiation, and to prevent the prediction of random numbers.

[0010] The problem is solved by a quantum random number generator with the features of claim 1, by a graphics chip with the features of claim 17 and by a method with the features of claim 18.

[0011] In one aspect, the present invention relates to a quantum random number generator for generating random numbers, comprising at least two entropy sources for generating an event; at least one evaluation unit for processing the event; an output interface for outputting a binary random number, wherein the entropy source comprises a photon source and a photon receiver; the photon source randomly emits photons, which are detected by the photon receiver and transmitted as an event to the evaluation unit. The evaluation unit is configured to process the events and generate binary random numbers, which are output via the output interface.

[0012] In another aspect, the invention relates to a graphics chip with such a quantum random number generator.

[0013] Further aspects of the invention relate to a corresponding method and a computer program product with program code for carrying out the steps of the method when the program code is executed on a processor.

[0014] Preferred embodiments of the invention are described in the dependent claims. It is understood that the features mentioned above and those to be explained below can be used not only in the combinations specified, but also in other combinations or individually, without departing from the scope of the present invention. In particular, the method and the computer program product can be implemented according to the embodiments described for the device in the dependent claims.

[0015] According to the invention, in the quantum random number generator, events suitable for generating random numbers are triggered in two independent entropy sources. The generation of random numbers can only be influenced by manipulating both entropy sources. To detect manipulation, the output of the entropy sources can be monitored and compared internally. It may be possible to detect the event rate of each individual entropy source. The event rate must approximately correspond to a predefined expected pattern. For example, if one of the two entropy sources does not produce any events over a longer period, external influence is likely. External manipulation is also highly probable if both entropy sources frequently generate events simultaneously. In this case, it is possible, for example, to issue a warning signal.

[0016] In a preferred embodiment, the quantum random number generator is configured such that the entropy sources interact with each other and with the evaluation unit. The resulting interaction is such that only one entropy source transmits an event or event signal to the evaluation unit at any given time. This creates an interdependence between the entropy sources and the evaluation unit. Interdependence refers to a mutual dependence between the respective elements.

[0017] To implement the interaction, a coupling element is connected between the entropy sources and the evaluation unit in a preferred embodiment. This coupling element can be, for example, an OR gate or a multiplexer. Other logic gates are also possible, as long as they allow switching back and forth between the at least two entropy sources and a selection to be made so that only the event signal of one of the entropy sources is sent to the evaluation unit.

[0018] A preferred embodiment of the quantum random number generator provides for an intermediate storage unit between the evaluation unit and the output interface to temporarily store the binary random numbers and forward them to the output interface with a delay. Direct output of the random numbers from the evaluation unit to the output interface could, for example, generate a current pulse or other increase in energy within the quantum random number generator, which could be detected externally. In this way, a direct correlation could be inferred between the binary random number, its value or category, and the respective pulse of the generator. Delayed output via the intermediate storage unit prevents such an inference or at least makes it significantly more difficult.

[0019] Preferably, controlled delay is achieved using a buffer. This control can relate, for example, to the delay time, which can be varied. Preferably, the delay or delay time is controlled by the entropy source. For instance, upon a newly generated event from the entropy source, the next current random number from the buffer could be output after a predetermined time interval. Alternatively, the control could be implemented using the evaluation unit. Depending on the currently generated random number, buffered random numbers can be output, or the time interval or delay time can be varied. Different delay times can be stored, for example, in a memory or table, which can be selected depending on the current (control) random number.Since such a selection criterion is not apparent from the outside, it makes it significantly more difficult or impossible to deduce which random number will be output next.

[0020] In a preferred embodiment, in addition to at least two entropy sources, several evaluation units are provided. Each entropy source is linked to an evaluation unit. Preferably, a one-to-one link is used. Each entropy source is linked to an evaluation unit so that its event signal can be evaluated by the evaluation unit and a corresponding random number is generated. Thus, multiple random numbers are available in the quantum random number generator.

[0021] A selection unit is therefore provided between the output interface and the individual evaluation units, so that an evaluation unit can be selected and linked to the output interface in order to output its generated random number at the output interface.

[0022] A particularly preferred configuration is one in which the number of entropy sources equals the number of evaluation units. Each entropy source and evaluation unit form a processing channel, so the quantum random number generator has multiple processing channels. The processing channels are connected to the selection unit in such a way that the random number generated by one of the processing channels can be output at the output interface.

[0023] The individual processing channels are preferably connected in parallel, whereby the components of the processing channels, i.e., the entropy sources and the evaluation units, do not influence each other. For example, there is no crosstalk between the individual processing channels.

[0024] In a preferred embodiment, a processing channel comprises, in addition to an entropy source and an evaluation unit, a buffer in which the binary random numbers generated by the evaluation unit can be temporarily stored.

[0025] In a preferred embodiment, in which the quantum random number generator has multiple processing channels, the selection unit is configured to establish a varying connection between one of the evaluation units and the output interface. This also applies if only multiple evaluation units are provided, but not multiple processing channels.

[0026] The connection between the evaluation units and the output interface via the selection unit can be dynamically varied. This variation can also be controlled, for example, by a separate control unit that may be integrated into the quantum random number generator. It is also possible to enable random variation of the connection between the evaluation unit and the output interface by the selection unit. The randomness can be generated and defined, for example, using a pseudorandom number. For instance, the variation executed by the selection unit could be based on a delayed or subsequent random number generated by the evaluation unit or one of the evaluation units. The selection of the evaluation units themselves can also be varied.

[0027] In a preferred embodiment, the selection unit is a multiplexer. It may also include an adder, an XOR gate, or another logic gate. The specific design of the selection unit is a matter for those skilled in the art and is known to them.

[0028] A preferred embodiment of the quantum random number generator includes a monitoring unit. The monitoring unit is designed to detect external manipulation. It is further designed to monitor the outputs of the entropy sources and / or the outputs of the evaluation units and / or the outputs of the buffers. Preferably, the outputs of identical components in parallel-connected devices can be monitored and checked. Preferably, it is checked whether the output values ​​of the identical components are the same or identical. If this is the case, the output of a binary random number at the output interface can preferably be blocked and prevented. For example, the corresponding binary random number could be deleted. Additionally or alternatively, it is possible to issue a warning, for example, in the form of a warning signal. The warning signal can replace the prevention of the output.

[0029] In a preferred embodiment, the monitoring unit of the quantum random number generator is configured to detect external manipulation. Preferably, the monitoring unit is configured to determine the number or frequency of the categories of binary random numbers output at the evaluation unit and / or the buffer. Preferably, manipulation is detected when the number of binary random numbers in one category exceeds the number of binary random numbers in another category by a predetermined threshold. The threshold can also be zero, allowing the number of numbers in the respective categories to be compared.

[0030] Manipulation can be detected more readily if the number of consecutive random binary numbers of the same category at the output of the evaluation unit and / or at the output of the buffer exceeds a predefined limit. In both cases, the random numbers are no longer uniformly distributed.

[0031] The category of the binary random number is its value. In other words, the category includes the values ​​0 and 1, so the random number can be either 0 or 1. The check is therefore whether more 1s or more 0s are generated and whether a uniform distribution of binary random numbers, defined over a longer period, prevails.

[0032] The preferred method is to monitor whether more binary random numbers of a category are generated than a predefined threshold, which represents an acceptable limit. Even with a uniform distribution of binary random numbers and their values, a higher frequency of one category may occur over a defined period, resulting in more 1s than 0s or vice versa. This can be perfectly acceptable as long as the overall threshold is not exceeded, meaning the binary random numbers remain uniformly distributed.

[0033] In a preferred embodiment, it is possible to delete a series of consecutive binary random numbers of the same category whose frequency does not meet a predefined criterion, for example, if too many random numbers of the same category follow one another. Additionally, the number of deleted series of random numbers can preferably be monitored. This allows for the detection of a possible attack or attempted manipulation.

[0034] Preferably, the number of deleted random number sequences can be compared to the number of undeleted random number sequences. A random number sequence is a predefined set of numbers. If this ratio exceeds a predefined value, potential manipulation can be detected. Accordingly, a warning signal can be issued, or the output of a random number at the output interface can be prevented.

[0035] In a preferred embodiment, the monitoring unit is configured to determine the number of binary random numbers of the same category in at least two of the processing channels. This involves counting the number of random numbers that are generated simultaneously in two processing channels and are identical. Ideally, these binary random numbers can be deleted.

[0036] Preferably, the number of binary random numbers of different categories is also counted in two processing channels and compared with those of the same category. The monitoring unit detects manipulation if the number of binary random numbers of the same category is greater than the number of those of different categories, or if the number of binary random numbers of the same category exceeds the number of binary random numbers of different categories by a certain threshold value.

[0037] It is also possible that binary random numbers of the same category are discarded (i.e., deleted) in two processing channels, and alternatively or additionally a warning signal is issued.

[0038] In a preferred embodiment of a quantum random number generator, multiple processing channels are provided, wherein the processing channels and their components are exposed to the same environmental conditions. In other words, the processing channels are affected in the same way by external manipulation. Interference between the individual processing channels, for example through crosstalk, is prevented by the design of the quantum random number generator.

[0039] Identical environmental conditions mean, for example, that all components of the quantum random number generator operate at the same voltage and are supplied by the same energy or current source. Externally applied light influences or mechanical stresses are also applied to all components through appropriate design. Changes in ambient temperature or component temperature within the quantum random number generator, induced from the outside, preferably affect all components equally. This makes it easier to detect tampering, as all components and / or processing channels are affected in the same way.

[0040] In a preferred embodiment, where the quantum random number generator has, for example, multiple processing channels, the components are interconnected to form a matrix arrangement or matrix structure. In this case, an entropy source of one processing channel is connected to an evaluation unit of another processing channel. Additionally or alternatively, an evaluation unit of one processing channel can be connected to a buffer of another processing channel. The corresponding connection or linking of the individual components of the respective processing channels can be created, for example, by connecting blocks or connecting elements. The connections can be static or variable. They can be controlled, for example, by an external control source or by a control source present in the quantum random number generator.Alternatively, the connection or the control of the individual connection elements can be based on generated random numbers or on previously generated random numbers. The connection elements could, for example, be a multiplexer.

[0041] In a preferred embodiment of the quantum random number generator, the evaluation unit is configured to determine a first time interval between two events and the entropy source, and a second interval between two subsequent events. Depending on the length of the time intervals, the evaluation unit generates a random number of a category, i.e., either a 0 or a 1. In a preferred embodiment, the assignment to one of the categories occurs according to predetermined time interval lengths. A particularly preferred embodiment allows the assignment of the category to the time interval lengths to be varied. This variation can be performed according to a predefined pattern, in a controlled manner, or also randomly.

[0042] In a preferred embodiment, the quantum random number generator comprises a test unit that generates an error signal in one or more processing channels, thereby initiating a self-test of the monitoring unit. This makes it possible to render the monitoring unit, or another attack detection unit, self-testable. The monitoring unit can thus verify itself using the test unit. For example, identical bits (error bits) can be injected into all processing channels. It is then verified whether this deliberately injected error is detected by the monitoring unit.

[0043] In a preferred embodiment, the monitoring unit is configured to calculate cross-correlation integrals of the random bit streams (for example, series of binary random numbers) in the various processing channels. This allows verification of whether the processing channels exhibit correlations that exceed a predefined limit, i.e., higher than permitted.

[0044] The problem to be solved, namely preventing manipulation of a quantum random number generator by external influences, is also achieved by means of the inventive method. The method requires a quantum random number generator with at least two processing channels, each of which comprises an entropy source and at least one evaluation unit. The method comprises several steps.

[0045] The first step involves temporarily storing the random numbers generated by the evaluation unit in a buffer.

[0046] In a further step, the distribution of random numbers in the buffer is determined. The buffer can be an external memory or one integrated into the random number generator. Additionally or alternatively, the distribution of random numbers can be determined in the intermediate memory of a processing channel and / or at the outputs of the evaluation unit or at the outputs of the intermediate memory of a processing channel.

[0047] In a further step, according to the invention, a termination signal and / or a warning signal is generated if an uneven distribution is detected during the determination of the distribution. Here, the distribution of the random numbers is monitored and evaluated over a predetermined time period.

[0048] The invention is described and explained in more detail below with reference to some selected embodiments in conjunction with the accompanying drawings. These show: Figure 1 shows a quantum random number generator according to the invention; Figure 2 shows a preferred embodiment of a quantum random number generator; Figure 3 shows two probability schemes with and without influence; Figure 4 shows another preferred embodiment of a quantum random number generator; Figure 5 shows an external influence on the random number generator; Figure 6 shows a graphics chip; and Figure 7 shows a schematic representation of the process of the method according to the invention.

[0049] Figure 1Figure 10 shows a schematic representation of a quantum random number generator (QRNG). The quantum random number generator has two entropy sources 20 that interact with an evaluation unit 30. Each entropy source 20 comprises a photon source, which can be, for example, a Zener diode, and a receiving diode, preferably a SPAD (Single Photon Avalanche Diode). The SPAD detects the photons randomly generated by the Zener diode and outputs an event or event signal at the output of the entropy source 20. This event signal can be, for example, a current spike or a rising edge of a current pulse.

[0050] Evaluation unit 30 analyzes the event signals from entropy source 20 and the times at which they occur. It prioritizes determining the time between two events and, in a further step, the time between two subsequent events. Based on these individual inter-event times and their ratios, the unit determines whether a logical 0 or a logical 1 is output at evaluation unit 30. Thus, evaluation unit 30 generates binary random numbers in two categories: 0 and 1. These are available at the output.

[0051] In the embodiment shown here, the two entropy sources 20 are connected to the evaluation unit 30 via a coupling element 22. In the simplest case, the coupling element 22 can be an OR gate, so that the event signals from one of the two entropy sources 20 are transmitted to the evaluation unit 30. Alternatively, the coupling element 22 can be a multiplexer or another logic gate.

[0052] The embodiment with at least two entropy sources 20 offers the possibility of realizing them in a small area, particularly when the coupling element 22 is designed as an OR gate. Such an embodiment exhibits low power consumption, since the second entropy source 20 is merely a standby backup. In parallel operation, for example using a multiplexer as the coupling element 22, full redundancy is achieved. This embodiment offers the advantage of improved performance during normal operation. Furthermore, such an embodiment demonstrates high robustness against random hardware failures.

[0053] At the output of the evaluation unit 30, a buffer 40 is provided in which the binary random numbers are temporarily stored for a predetermined time before being output with a delay at an output interface 50. This offers the advantage that no direct inference is possible between the binary random number generated at the output of the evaluation unit 30 and the binary random number output.

[0054] The outputs of the evaluation unit 30 and the buffer 40, as well as the outputs of the two entropy sources 20, are monitored by a monitoring unit 60. The monitoring unit 60 offers the capability to detect external tampering attempts. These can be caused, for example, by exposure to light or other electromagnetic waves, or by temperature fluctuations. External manipulation of the power supply, such as changes in current or voltage, is also possible.

[0055] For example, the monitoring unit 60 can be trained to compare the outputs of the two entropy sources 20 and to determine if there is an accumulation of events or a change in the event rate.

[0056] Figure 2 Figure 1 shows a preferred embodiment of the quantum random number generator 10, in which two parallel processing channels 70 are implemented. Each processing channel 70 comprises an entropy source 20, an evaluation unit 30 coupled to this entropy source 20, and a buffer 40. The outputs of the respective entropy sources 20, evaluation units 30, and buffers 40 are monitored in a monitoring unit 60. At the end of the processing channels 70, one of the signals is selected by means of a selection unit 80 and routed to the output interface 50. The selection unit 80, which is preferably a multiplexer, can be controlled via a control unit 82.

[0057] The at least two processing channels 70 are implemented such that they are preferably completely uncorrelated and operate without crosstalk. For optimal external shielding, a housing for the quantum random number generator 10 can be used, for example. At the same time, the two processing channels 70 are positioned so close together that they operate under as similar environmental conditions as possible. They are both powered by the same supply voltage and would be subjected to the same interference signals if influenced from the outside. Changes in temperature or light levels from the outside also affect both processing channels 70 equally.

[0058] Under normal operating conditions, the outputs of the two processing channels 70 are uncorrelated. The probability that the outputs of the two paths will reach the same states or categories of random numbers is the product of these probabilities. The probability that both processing channels 70 generate a logical 1 is the result of multiplying the probability of the first processing channel 70, (A), by the probability of the second processing channel 70, (B), outputting a logical 1. The same applies to the output of two logical zeros as a category of binary random numbers from both processing channels 70. Output (1, 1) = PA (1) * PB (1) Output (0, 0) = PA (0) * PB (0)

[0059] In the event of manipulation of the environmental conditions or from the outside, an attacker changes the probability of a logical 1 or a logical 0. However, the manipulation affects both processing channels equally, so the probability of identical outputs increases.

[0060] The monitoring unit 60 can monitor the frequency of identical outputs, i.e., binary random numbers in the same category, in both processing channels 70. If this frequency is statistically significantly higher than expected, a warning is issued. Optionally, or alternatively, the output of binary random numbers in the same category can be discarded, and only unequal binary random numbers can be output. The monitoring can be configured as described in Figure 2It has been shown that processing can also be carried out in parallel at several points in the process with different sample sizes and different limits at various points in the processing channels 70 to further improve diagnostic coverage and allow conclusions to be drawn about the type of manipulation or attack. Figure 2 As shown, the outputs of the entropy sources 20, the evaluation units 30 and the intermediate storage 40 are monitored for this purpose.

[0061] Figure 3 The output of the two processing channels 70 is shown as A and B, along with the probabilities that the binary random number is a 1 or a 0. These probabilities are equally distributed under normal operating conditions, so the output at each processing channel 70 might be, for example, the following: Figure 3The sequence of binary random numbers shown is as follows. It is evident that there is a uniform distribution of the random numbers within each processing channel 70, but also a uniform distribution of the differences or similarities of the binary random numbers between the respective channels A and B.

[0062] In the lower part of Figure 3 Figure 70 illustrates how the probability of a logical 0 or a logical 1 being output at the end of each processing channel is manipulated externally. This results in the following sequence of binary random numbers for channels A and B, where identical binary random numbers or binary random numbers of the same category are output.

[0063] In the previous Figures 1 and 2 Two entropy sources 20 and two processing channels 70 were provided, respectively. Of course, more processing channels 70 or multiple entropy sources 20 can also be provided.

[0064] Figure 4Figure 1 shows an embodiment with essentially three processing channels 70, which are not explicitly depicted. Rather, the entropy sources 20, the evaluation units 30, and the intermediate storage units 40 are arranged in the form of a matrix. Here, the respective elements entropy source 20, evaluation unit 30, and intermediate storage unit 40 each form a column, while the processing channels 70 represent a row of the matrix. Between each column, i.e., between the entropy sources 20 and the evaluation units 30, and between the evaluation units 30 and the intermediate storage units 40, a selection unit 80 is arranged, which can be controlled by a control unit 82. Preferably, the selection units 80 are multiplexers that make it possible to link the entropy source 20 of the first row with the evaluation unit 30 of the second row, and the latter with the intermediate storage unit 40 of the third row.These links are represented by differently dashed lines.

[0065] The specific linking process can be controlled by the control unit 82. The linking and interconnection of the individual elements of the quantum random number generator 10 is therefore dynamic, variable, or random. For this purpose, a random number generated in one of the evaluation units 30 can also be used. At the end of each series, the intermediate storage units 40 are connected to a further selection unit 80, which selects one of the binary random numbers available in the intermediate storage units 40. This number is then output from the random number generator via the output interface 50.

[0066] The monitoring unit 60 monitors the outputs of the individual entropy sources 20, evaluation units 30 and intermediate storage 40.

[0067] Predicting the random numbers (binary random numbers) in the output by observing the outputs of the entropy sources 20 and / or evaluation units 30 and / or intermediate storage 40 or output interface 50 is made more difficult because the assignment or linking of the individual elements is dynamic.

[0068] For example, if a current spike is observed externally during an event at an entropy source 20, then with only one processing channel 70 ( Figure 1 ) simply deduce how long the times are between the individual events. Through correlation, it can then be observed when a logical 0 and when a logical 1 is output. However, if, as in Figure 2 or 4Since multiple redundant paths are used, it is impossible to distinguish which processing channel 70 the current peak of an entropy source 20 belongs to, as they share a common energy or voltage source. Furthermore, since it is not apparent which output occurs on which processing channel 70 or from which buffer 40 it is generated, no prediction can be made of the binary random number output at the output interface 50.

[0069] By implementing with multiple processing channels 70 or with the matrix arrangement according to Figure 4 This allows for improved confidentiality of internal conditions. Furthermore, the respective monitoring unit 60 is trained to detect tampering attempts by checking and comparing the outputs of the respective components.

[0070] As in the Figures 2 and 4As shown, various entropy sources 20 share the environmental conditions, in particular the supply voltage. Among the aims of this design are that the entropy sources 20 are uncorrelated and that identical environmental conditions exist for all entropy sources. The monitoring unit 60 checks for a possible correlation between the individual entropy sources 20.

[0071] Figure 5The diagram shows a timeline at the output of the entropy sources 20. A first event is detected at time t0, and a second event at time t1. The intervening time interval is the inter-event time a. The times of the two subsequent events t2 and t3 are also determined, and the inter-event time b is calculated from these. In the evaluation unit 30, the individual times are evaluated, and a logical 1 is output if the inter-event time a is greater than the inter-event time b. If the inter-event time b is greater than a, a logical 0 is output. If both times are equal, no output is generated.

[0072] If one considers the inter-event time (IE-t) over a longer period, it remains constant during normal operation. Therefore, the probability of outputting category 1 (a logical 1) or category 0 (a logical 0) is also equal.

[0073] When influenced from the outside, i.e., when an external disturbance occurs, such as when the quantum random number generator 10 cools down, the generator becomes faster overall, and the inter-event time decreases. This results in significantly more logical 1s than logical 0s being output.

[0074] For example, if the voltage is increased, the generator heats up and the overall processing slows down. This results in an increase in the inter-event time. Consequently, the probability of a 1 becomes significantly lower than the probability of a logical 0. Such behavior, for example in evaluation unit 30, can be detected by monitoring unit 60.

[0075] To further increase the robustness of the quantum random number generator 10, enabling it to generate random numbers undisturbed despite an active external attack, the logical assignment of the time intervals can be inverted. While the sequence in a normal measurement process is a, b, a, b, ..., in a robust measurement process it could be a, b, b, a, ... For example, the time interval a = t1 - t0 and b = t3 - t2 in normal operation. In robust operation, the assignment could be partially reversed, so that b = t1 - t0 and a = t3 - t2.

[0076] Figure 6 Figure 1 shows a schematic representation of a graphics chip 90 comprising a quantum random number generator 10 according to the invention. This quantum random number generator 10 can be configured as described above, for example according to Figure 1. Figure 2 or 4 .

[0077] Figure 7Figure 1 shows the basic process of the inventive method for protecting a quantum random number generator from external manipulation and for detecting such manipulation. The quantum random number generator 10 has at least two processing channels 70, each channel comprising an entropy source 20 and at least one evaluation unit 30. The method has several steps: In a first step S10, the random numbers generated by the evaluation unit 30 are temporarily stored in a buffer. This buffer can be a separate storage device. The buffer can represent a single component for each of the processing channels 70. It can be integrated into the quantum random number generator 10.

[0078] In a further step S12, the distribution of the random numbers in the buffer is determined. Additionally or alternatively, the distribution of the random numbers can also be performed in a temporary storage area of ​​a processing channel 70.

[0079] In a further step S14, according to the invention, a termination signal and / or a warning signal is generated if an uneven distribution of the random number values ​​is detected during the determination of the distribution. Preferably, the distribution of the random numbers is monitored and evaluated over a predetermined time period. This ensures that a sufficiently large number of random numbers are considered. With a small number of random numbers, an uneven distribution may well exist, as long as it remains below a predetermined limit. The random numbers, which are preferably binary random numbers, can therefore have two categories: a logical 1 and a logical 0. The uneven distribution thus indicates that the number of random numbers in one category is significantly larger than in the other, suggesting external manipulation.

[0080] In a preferred embodiment, the method comprises further optional steps S20 to S24, which are shown as dashed lines. Step S20 involves detecting an event rate, at least from one of the entropy sources 20. In a further step S22, it is checked whether the event rate lies within a permissible predefined range. This check verifies whether enough events are generated in a given time interval or whether the number of events does not exceed a permissible threshold, i.e., whether too many events are generated within a time period. This, too, could indicate an external influence.

[0081] In a further step, S24, a termination signal or a warning signal is generated if the event rate is outside the permissible and predefined range. This range can depend on the specific method and application.

[0082] In a further preferred embodiment, the method includes additional optional steps S30 to S38. In step S30, two groups of two events each from an entropy source (20) are detected. Optionally, the times or time intervals between two events of each group can also be determined and / or counted. It is possible that only the events are detected and passed on directly, preferably without delay (of more than one clock cycle).

[0083] In a further step S32, the events and, optionally, the times at which the events occur are transmitted to an evaluation unit 30 of a processing channel 70. Preferably, only the events are transmitted to evaluation unit 30, and the times are determined there. A time can be determined by starting a counter, for example a TDC, or by counting.

[0084] Counting, as defined in the invention, is not simply understood as increasing a value by a count value or decreasing a starting value by a count value. Rather, counting can generally mean that a given or variable number of time slots between two events are assigned exactly one uniquely bijectively assignable count value per time slot, thus establishing a one-to-one, reversible relationship between time slot and count value. Preferably, the last count value before the detection of the next event is used. The time slots can be generated, for example, by a time slice, preferably determined by the clock of the generator. The sequence of the count values ​​can then be determined, for example, by a pseudorandom number generator driven by the clock of the generator, whereby it is only necessary to ensure that each count value occurs only once in the respective counting interval.The number of count values ​​can depend on the time difference between the occurrence of the events. These count values, as pseudorandom numbers, can be generated, for example, using linearly fed shift registers, which are themselves fed back by simple primitive polynomials.

[0085] A further step, S34, involves evaluating the times and determining the time intervals between them. Another step, S36, concerns generating a random number based on an assignment of a random number category to the time intervals. In a further step, S38, the procedure includes a sporadic modification of this assignment. This modification of the assignment provides protection against eavesdropping on the random number generator, as no inferences can be drawn from current spikes in the generator or from light emitted during the generation of an event to the random numbers and their values.

[0086] Alternatively, steps S30 and S32 can also include or be designed as: measuring two time intervals between each pair of events of an entropy source 20; and transmitting the events and the times at which the events occur to each evaluation unit 30 of a processing channel 70.

[0087] Preferably, the method according to the invention comprises a further optional step S40. This step S40 involves the sporadic modification of the linking of the components or elements of the individual processing channels 70 to one another. The linking is thus carried out in such a way that a new processing channel 70 is formed in each instance, which, however, does not correspond to the conventionally planned processing channel 70. In this way, for example, a matrix arrangement of the individual components or component elements is realized. Thus, it is no longer possible to infer from generated events to output, delayed random numbers, particularly if the assignment of the components (entropy source, evaluation unit, intermediate storage) is unknown.

[0088] The individual steps of the procedure and the optional steps can, at least in part, be carried out in a different order. Repetitions of individual steps are possible. It is not necessary to carry out all steps.

[0089] The steps of the procedure and its optional steps can be performed by the quantum random number generator 10 described above in its various configurations. Parts of the procedure can be distributed across different components of the quantum random number generator 10 and executed by these components or elements. The procedure can be implemented wholly or partially by computer and / or machine.

[0090] The invention has been comprehensively described and explained with reference to the drawings and the description. The description and explanation are to be understood as examples and not as limiting. The invention is not limited to the disclosed embodiments. Other embodiments or variations will become apparent to a person skilled in the art when using the present invention and upon a detailed analysis of the drawings, the disclosure, and the subsequent claims.

[0091] In the claims, the words "comprise" and "with" do not preclude the presence of further elements or steps. The undefined article "a" or "an" does not preclude the presence of multiple elements. A single element or unit can perform the functions of several of the units mentioned in the claims. An element, unit, and device can be implemented partially or completely in hardware and / or software. The mere mention of some measures in several different dependent claims is not to be understood as precluding the advantageous use of a combination of these measures. Reference numerals in the claims are not to be interpreted restrictively. Reference sign

[0092] 10 Quantum random number generator 20 Entropy source 22 Coupling element 30 Evaluation unit 40 Buffer 50 Output interface 60 Monitoring unit 70 Processing channel 80 Selection unit 82 Control unit 90 Graphics chip

Claims

1. Quantum random number generator (10) for generating random numbers comprising: - at least two entropy sources (20) for generating an event; - at least one evaluation unit (30) for processing the event; - an output interface (50) for outputting a binary random number; wherein the entropy source (20) comprises a photon source and a photon receiver; the photon source randomly emits photons which are detected by the photon receiver and transmitted as an event to the evaluation unit (30); the evaluation unit (30) is configured to process the events and generate binary random numbers which are output via the output interface (50).

2. Quantum random number generator (10) according to claim 1, characterized by the fact that the entropy sources (20) interact with each other and with the evaluation unit (30).

3. Quantum random number generator (10) according to any one of the preceding claims, characterized by the fact thatA coupling element (22) is connected between the entropy sources (20) and the evaluation unit (30), which is preferably an OR gate or a multiplexer (MUX).

4. Quantum random number generator (10) according to any one of the preceding claims, characterized by the fact that An intermediate storage (40) is provided between the evaluation unit (30) and the output interface (50) to temporarily store the binary random numbers and forward them to the output interface (50) with a delay, wherein the delay / delay time can preferably be controlled, particularly preferably by the entropy source (20) or the evaluation unit (30).

5. Quantum random number generator (10) according to any one of the preceding claims, characterized by the fact thatseveral evaluation units (30) are provided and each of the entropy sources (20) is linked to an evaluation unit (30), with a selection unit (80) provided between the evaluation unit (30) and the output interface (50).

6. Quantum random number generator (10) according to the preceding claim, characterized by the fact that the number of entropy sources (20) is equal to the number of evaluation units (30) and several processing channels (70) are provided, each processing channel (70) comprising an entropy source (20) and an evaluation unit (30) and the processing channels (70) being connected to the selection unit (80).

7. Quantum random number generator (10) according to claim 5 or 6, characterized by the fact thatthe selection unit (80) establishes a varying connection between one of the evaluation units (30) and the output interface (50), wherein the connection varies dynamically, is controlled, or varies randomly, and the connection is based on a random value, preferably a delayed one.

8. Quantum random number generator (10) according to one of claims 5 to 7, characterized by the fact that the selection unit (80) comprises a multiplexer, an XOR gate, an adder or a logic gate.

9. Quantum random number generator (10) according to one of the preceding claims characterized by the fact thata monitoring unit (60) is provided which is designed to detect manipulation from the outside and to monitor the outputs of the entropy sources (20) and / or the outputs of the evaluation units (30) and / or the outputs of the intermediate storage units (40), preferably, if the output values ​​of the same components are the same or identical, either the output of a binary random number at the output interface (50) is suppressed and prevented or alternatively or additionally a warning is issued.

10. Quantum random number generator (10) according to the preceding claim, characterized by the fact thatthe monitoring unit (60) is designed to determine the number or frequency of the categories of binary random numbers output at the output of the evaluation unit (30) and / or the intermediate storage (40), and preferably detects manipulation if the number of binary random numbers of one category is greater than the number of binary random numbers of the other category by a predetermined threshold, where the threshold may be zero, or if the number of binary random numbers of one category is greater than a predetermined threshold.

11. Quantum random number generator (10) according to claim 9 or 10, characterized by the fact thatthe monitoring unit (60) is designed to determine the number of consecutive binary random numbers at the output of the evaluation unit (30) and / or the intermediate storage (40) and to detect manipulation if the number of consecutive binary random numbers of the same category is greater than a predetermined threshold or than the number of binary random numbers of alternating categories, preferably deleting the consecutive binary random numbers of the same category that exceed the threshold.

12. Quantum random number generator (10) according to one of claims 9 to 11, characterized by the fact thatthe monitoring unit (60) is designed to determine the number of binary random numbers of the same category in at least two processing channels and to compare it with the number of binary random numbers of different categories and to detect manipulation if the number of same categories is greater or exceeds the number of different categories by a threshold.

13. Quantum random number generator (10) according to any one of the preceding claims 6 to 12, characterized by the fact that the processing channels (70) are exposed to the same environmental conditions, preferably including the same operating voltage, temperature, light influences, energy source, current source, mechanical stress.

14. Quantum random number generator (10) according to any one of the preceding claims 6 to 12, characterized by the fact thatThe quantum random number generator (10) has several processing channels (70), wherein an entropy source (20) of one processing channel (70) is connected to an evaluation unit (30) of another processing channel (70) and / or an evaluation unit (30) of one processing channel (70) is connected to an intermediate storage (40) of another processing channel (70), preferably forming a matrix arrangement.

15. Quantum random number generator (10) according to any one of the preceding claims, characterized by the fact that the evaluation unit (30) determines a first time interval between two events of the entropy source (20) and a second time interval between two later events and generates a random number of a category depending on the lengths of the time intervals, whereby the assignment of the category to the time interval lengths can preferably vary.

16. Quantum random number generator (10) according to any one of the preceding claims, characterized by the fact thata test unit is present which generates an error signal in one or more processing channels (70) and initiates a self-test of the monitoring unit (60).

17. Graphics chip (90) with a quantum random number generator (10) according to one of the preceding claims.

18. Method for securing a quantum random number generator (10) against external manipulation, wherein the quantum random number generator (10) has at least two processing channels (70) each with an entropy source (20) and an evaluation unit (30), comprising the following steps: temporarily storing the generated random numbers in a buffer; determining a distribution of the random numbers in the buffer; generating a termination signal and / or warning signal if an uneven distribution is present.

19. Method according to the preceding claim, characterized byThe further steps are: Detect an event rate of at least one entropy source (20); Check whether the event rate is within a permissible, predefined range; Generate a termination signal and / or warning signal if the event rate is outside the permissible, predefined range.

20. Method according to claim 18 or 19, characterized by The further steps are: determining two groups of two events each from an entropy source (20) and optionally two time intervals between two events of each group; transmitting the events and optionally the times to one evaluation unit (30) of a processing channel (70); evaluating the times and determining time intervals between the times; setting a random number based on an assignment of a category of random number to the time intervals; sporadically changing the assignment.

21. Method according to one of claims 18 to 20, characterized byThe next step: sporadic changes to the linking of the components between the processing channels.

Images